HTTP Security Headers Analyzer fetches your site over HTTPS with native sockets — capturing real DNS, TCP, TLS handshake, first-byte, and download timings — then parses every response header and grades it against a modern baseline. Checks HSTS preload eligibility (max-age, includeSubDomains, preload directive), parses CSP into directives and flags `unsafe-inline` / wildcards / missing `object-src`, audits every `Set-Cookie` for Secure / HttpOnly / SameSite / prefix rules, warns on deprecated headers (X-XSS-Protection, HPKP, Expect-CT), and generates ready-to-paste nginx / Apache / Express snippets for every header you're missing. Single A–F grade you can share with a PM.
Twelve security headers, graded against modern best-practice values — not just 'present or absent' but 'configured correctly'. The grade is composite; the per-header breakdown tells you exactly what to fix.
Tells browsers to always connect over HTTPS. Graded on max-age (≥ 31536000), `includeSubDomains`, and `preload` (the strictest configuration enrolls the domain in the HSTS preload list, baked into Chrome, Firefox, and Safari shipping).
Whitelists which sources scripts, styles, frames, and other resources may load from. The strongest single defense against XSS. Graded on `default-src` strictness, presence of `'unsafe-inline'` / `'unsafe-eval'` (both significantly weaken protection), nonce/hash usage, and `frame-ancestors`.
Prevents your site from being embedded in iframes on other origins (UI redress / clickjacking attacks). `DENY` or `SAMEORIGIN` accepted. Modern best practice: replace with CSP `frame-ancestors` which is more granular.
`nosniff` prevents browsers from second-guessing the declared content-type. Without it, a file labeled `text/plain` containing HTML could be executed as a script under some conditions. Cheap to set; should always be present.
Controls how much Referer information is sent to third-party origins. Best practice: `strict-origin-when-cross-origin` or `no-referrer`. Mitigates leak of sensitive path/query data in outbound requests.
Restricts which browser features (geolocation, camera, microphone, payment, USB, etc) can be used by your origin and embedded iframes. Hardening reduces attack surface from compromised third-party scripts.
`same-origin` enables cross-origin isolation, which unlocks high-resolution timers and shared memory and gives stronger protection against Spectre-class attacks. Increasingly important for security-sensitive sites.
Pairs with COOP. `require-corp` means cross-origin resources must opt in via CORP or CORS. The combination of COOP + COEP is what enables `crossOriginIsolated` in modern browsers.
Every `Set-Cookie` is parsed individually. Each cookie is checked for `Secure`, `HttpOnly`, `SameSite`, and the `__Host-` / `__Secure-` prefix rules (`__Host-` requires Secure, no Domain, Path=/). Missing flags surface as per-cookie issues rather than a blanket 'insecure' label.
Native `http`/`https` request with socket-timing hooks — captures DNS lookup, TCP connect, TLS handshake, first-byte, and download time separately. Also reports `content-encoding`, actual compression ratio (decompresses gzip/deflate/br to compare), total size, and cache status parsed from `cf-cache-status` / `x-cache` / `age`.
Every redirect hop is captured — URL, status code, time — up to five hops. Detects HTTP→HTTPS enforcement (if the initial `http://` request lands on `https://` at the end), redirect loops, and unnecessary chains that inflate TTFB.
Flags `X-XSS-Protection` (ignored by modern browsers), `Public-Key-Pins` (removed from Chromium), `Expect-CT` (deprecated as of Chrome 107), and legacy `Feature-Policy`. Also surfaces `Server` and `X-Powered-By` as fingerprinting leaks — one config line hides them.
Most security headers are one-line config changes that immediately raise the cost of common attacks. Five reasons they're underrated:
A header check is one HTTPS request, five parsers, and a scored report. We use Node's native `http`/`https` (not a wrapper) so we can hook the socket lifecycle and report the real time each phase took.
CSP is the most powerful security header — and the hardest to configure. Done well, it eliminates XSS. Done poorly, it provides false security or breaks the site. Five things to know:
Most 'header check' tools return one number — total request time. That hides the interesting question: where did the ms go? Was it DNS? The TLS handshake? The server itself? We wire listeners onto the socket lifecycle so every phase is measured separately.
The gap between 'I know I need this header' and 'I've deployed it' is usually five minutes of googling the right config syntax. We generate it for you — modern best-practice values, ready to drop into your server config or middleware.
# Drop into your server{} block. `always` ensures headers ship on error responses too.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()" always;
# Suppress fingerprinting
server_tokens off;
more_clear_headers 'Server' 'X-Powered-By';# Requires mod_headers. Drop into your VirtualHost or .htaccess.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()"
# Suppress fingerprinting
ServerTokens Prod
Header unset Server
Header unset X-Powered-By// Option A: helmet (most Express apps)
import helmet from 'helmet';
app.use(helmet({
strictTransportSecurity: {maxAge: 31536000, includeSubDomains: true, preload: true},
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
objectSrc: ["'none'"],
baseUri: ["'self'"],
frameAncestors: ["'none'"],
upgradeInsecureRequests: [],
},
},
referrerPolicy: {policy: 'strict-origin-when-cross-origin'},
permittedCrossDomainPolicies: false,
}));
app.disable('x-powered-by');
// Option B: hand-rolled middleware
app.use((req, res, next) => {
res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
res.setHeader('Content-Security-Policy', "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; upgrade-insecure-requests");
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
res.setHeader('Permissions-Policy', 'accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()');
next();
});
app.disable('x-powered-by');Every header, per-header grade, and recommendation is available as JSON. Useful for CI gates that prevent regressing security headers, vendor due diligence, and continuous header-monitoring across a portfolio of sites.
curl 'https://api.domainscan.in/api/v1/security/headers?domain=github.com'const res = await fetch(
'https://api.domainscan.in/api/v1/security/headers?domain=github.com'
);
const {data} = await res.json();
console.log(data.grade); // 'A'
console.log(data.score); // 90
console.log(data.duration, 'ms total'); // 235
// Performance breakdown
const p = data.performance;
console.log(`DNS ${p.dnsLookupTime}ms · TCP ${p.tcpConnectTime}ms · TLS ${p.tlsHandshakeTime}ms · TTFB ${p.firstByteTime}ms`);
console.log(`Encoding: ${p.encoding} · Compression: ${(p.compressionRatio * 100).toFixed(0)}%`);
// HSTS preload check
if (data.analysis.hsts.preloadEligible) {
console.log('HSTS preload-ready — submit at hstspreload.org');
}
// CSP findings
data.analysis.csp.findings.forEach(f => {
console.log(`[${f.severity}] CSP: ${f.text}`);
});
// Cookie audit
data.analysis.cookies.cookies.forEach(c => {
if (c.issues.length) console.log(`Cookie ${c.name}: ${c.issues.join('; ')}`);
});
// CI gate: fail build if grade regresses
if (['D', 'F'].includes(data.grade)) {
console.error('Security headers grade regressed:', data.grade);
process.exit(1);
}
// Copy-paste snippets for missing headers
Object.entries(data.snippets).forEach(([header, tpl]) => {
console.log(`\n# ${header} — nginx`);
console.log(tpl.nginx);
});{
"success": true,
"url": "https://github.com",
"status": 200,
"protocol": "https",
"duration": 235,
"score": 90,
"grade": "A",
"performance": {
"dnsLookupTime": 47,
"tcpConnectTime": 28,
"tlsHandshakeTime": 53,
"firstByteTime": 161,
"downloadTime": 72,
"totalSize": 126333,
"uncompressedSize": 577068,
"compressionRatio": 0.219,
"encoding": "gzip",
"cacheStatus": "hit",
"redirectCount": 0,
"redirectChain": [{"url": "https://github.com", "status": 200, "duration": 235}]
},
"analysis": {
"hsts": {
"present": true,
"maxAge": 31536000, "maxAgeDays": 365,
"includeSubDomains": true, "preload": true,
"preloadEligible": true
},
"csp": {
"present": true, "reportOnly": false, "directiveCount": 8,
"findings": [
{"severity": "low", "text": "style-src allows 'unsafe-inline'"},
{"severity": "info", "text": "upgrade-insecure-requests enabled"}
]
},
"cookies": {
"present": true, "count": 3,
"cookies": [
{"name": "_gh_sess", "secure": true, "httpOnly": true, "sameSite": "lax", "issues": []},
{"name": "_octo", "secure": true, "httpOnly": false, "sameSite": "lax",
"issues": ["Missing HttpOnly — accessible to JavaScript (XSS risk)"]}
]
},
"redirects": {"enforcesHttps": true, "httpRedirectsToHttps": false, "finalUrl": "https://github.com"},
"deprecated": [
{"header": "X-XSS-Protection", "severity": "low", "message": "Deprecated. Modern browsers ignore it. Rely on CSP."}
]
},
"snippets": {
"Permissions-Policy": {
"value": "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()",
"nginx": "add_header Permissions-Policy \"...\" always;",
"apache": "Header always set Permissions-Policy \"...\"",
"express": "res.setHeader('Permissions-Policy', '...');"
}
},
"headers": {"strict-transport-security": "...", "content-security-policy": "..."}
}Six patterns we see most often:
Wire the API into your CI/CD pipeline. Block deploys that regress the security-headers grade. Catches the well-intentioned middleware change that accidentally removed HSTS three releases ago.
PCI-DSS, SOC 2, ISO 27001, HIPAA audits all reference HTTP security headers. A documented A or A+ grade satisfies the relevant controls without manual evidence-gathering.
Evaluating a SaaS that will handle your customer data. Their security-headers grade is a leading indicator of broader security maturity. F-grade sites correlate with deeper issues.
Before paying for an external pen test, run security-headers and other low-hanging-fruit checks. Fix the obvious findings yourself; let the pen-testers spend their hours on harder issues.
Run the checker against every public site of a target acquisition. The header grades tell you how much post-acquisition hardening work to expect.
Cron the API against your portfolio of sites. Alert on grade regressions. Catches the silent drift when a new CDN config or middleware change accidentally removes a critical header.